generated: '2026-09-10'
method: probed
source: >-
  Derived from openapi/ and confirmed against live responses from https://a-fsw.com/wp-json/ on 2026-09-10.
  Compliance claims were searched across all 14 published AEE pages; none were found.
summary: >-
  The AEE read surface conforms to the small set of web standards WordPress core implements — RFC 8288 link
  pagination, CORS, and a HAL-flavoured link envelope. It conforms to none of the API-industry or
  identity standards, and AEE publishes no certification, audit report or compliance program. No Compliance
  pointer is emitted in apis.yml, because there is no published compliance program to point at.
conformance:
- id: rfc8288-web-linking
  name: RFC 8288 Web Linking
  conforms: true
  evidence: 'Link header observed on https://a-fsw.com/wp-json/wp/v2/product?per_page=2&page=1 -> <https://a-fsw.com/wp-json/wp/v2/product?per_page=2&page=2>; rel="next"'
- id: cors
  name: Cross-Origin Resource Sharing
  conforms: true
  evidence: 'Access-Control-Expose-Headers: X-WP-Total, X-WP-TotalPages, Link and Access-Control-Allow-Headers observed on wp-json responses.'
- id: pagination
  name: Documented, parameterised pagination
  conforms: true
  evidence: 'page/per_page/offset parameters plus X-WP-Total and X-WP-TotalPages counters, enumerated in the server''s own OPTIONS documents and reproduced in openapi/.'
- id: hal
  name: HAL (Hypertext Application Language)
  conforms: partial
  evidence: 'Every resource carries _links with curies and self/collection/about/wp:term relations, and _embed inlines them into _embedded (verified on /wp/v2/product). This is WordPress''s HAL-flavoured envelope, not a formal application/hal+json media type — responses are served as application/json.'
- id: rfc9457-problem-details
  name: RFC 9457 Problem Details for HTTP APIs
  conforms: false
  evidence: 'Errors use the WordPress {code,message,data} envelope at application/json, not application/problem+json. Confirmed on a live 400 from /wp/v2/product?per_page=999.'
- id: json-api
  name: 'JSON:API'
  conforms: false
  evidence: 'No application/vnd.api+json media type and no data/attributes/relationships document structure.'
- id: oauth2
  name: OAuth 2.0
  conforms: false
  evidence: '/.well-known/oauth-authorization-server returned 404 on a-fsw.com; no oauth2 securityScheme is declared or served.'
- id: oidc
  name: OpenID Connect
  conforms: false
  evidence: '/.well-known/openid-configuration returned 404 on a-fsw.com.'
- id: idempotency
  name: Idempotency keys for unsafe methods
  conforms: na
  evidence: 'No publicly reachable mutating operation exists; see conventions/ idempotency.applicable=false.'
- id: rfc8594-sunset
  name: RFC 8594 Sunset header
  conforms: false
  evidence: 'No Sunset or Deprecation header observed on any probed route.'
- id: rfc9116-security-txt
  name: RFC 9116 security.txt
  conforms: false
  evidence: 'https://a-fsw.com/.well-known/security.txt returned 404.'
domain_standard:
  found: false
  searched_for: [opc-ua, mtconnect, umati, iso-9001, iso-3834, en-15085, aws-d17.3]
  note: >-
    REWARD-ONLY AND CORRECTLY EMPTY. The relevant domain standards for a machine-tool builder are shop-floor
    interoperability standards (OPC UA, MTConnect, umati) and welding quality standards (ISO 3834,
    EN 15085, AWS D17.3). None is declared in the contract, and the contract could not plausibly carry one:
    it describes a marketing website's content, not a machine interface. The API Evangelist scoring rubric
    also defines no regulatory regime for manufacturing or industrial equipment, so nothing is scored here
    and nothing is penalised.
compliance_program:
  published: false
  certifications: []
  trust_center: false
  searched:
  - {url: 'https://a-fsw.com/about-us/', status: 200, result: 'Company narrative; no certification claim found.'}
  - {url: 'https://a-fsw.com/service/', status: 200, result: 'No certification claim found.'}
  - {url: 'https://a-fsw.com/faq/', status: 200, result: 'No certification claim found.'}
  - {url: 'https://a-fsw.com/privacy-policy/', status: 200, result: 'Website privacy notice only; no security program.'}
  note: >-
    AEE publishes no SOC 2, ISO 27001, PCI, HIPAA or FedRAMP attestation and operates no trust center.
    This is expected for a capital-equipment manufacturer with no software product.